CVE-2026-112356

GFI KerioConnect Kerio Connect before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose te...

EUVD-2026-112138

GFI KerioConnect Kerio Connect before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose te...

CVE-2026-112356 GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter

GFI KerioConnect Kerio Connect before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose te...

CVE-2026-112356 GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter

GFI KerioConnect Kerio Connect before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose te...

CVE-2026-112356

GFI KerioConnect (Kerio Connect) versions prior to 10.0.9 Patch 2 are susceptible to a cross-site scripting (XSS) vulnerability within the Webmail component . The root cause is the link auto-formatter's re-processing of text already contained within a link; an attacker can use quote characters to...

Roundcube-CVE-2024-42008-POC

CVE-2024-42008 RoundCube XSS Exploit Overview This repository contains a proof-of-concept exploit for CVE-2024-42008 , a Cross-Site Scripting XSS vulnerability in RoundCube webmail application. This exploit is designed for educational purposes and controlled penetration testing environments like...

CVE-2025-49113-Roundcube-RCE-PHP

CVE-2025-49113-Roundcube-RCE-PHP Roundcube Webmail versions 1.5.0 through 1.6.10 This is a rewritten exploit to work with PHP. Usage php CVE-2025-49113.php...

PT-2026-128259

GFI KerioConnect Kerio Connect before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose te...

CVE-2026-112356: Improper Neutralization of Input During Web Page Generation

GFI KerioConnect Kerio Connect before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose te...

CVE-2026-112353

GFI KerioConnect Kerio Connect before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of...

EUVD-2026-111136

GFI KerioConnect Kerio Connect before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of...

CVE-2026-112353

GFI KerioConnect (Kerio Connect) versions before 10.0.8 Patch 2 are susceptible to a stored cross-site scripting (XSS) vulnerability within the Webmail component. An attacker can upload a crafted SVG email attachment that bypasses sanitization of event-handler attributes. By exploiting an insuffi...

CVE-2026-112353 GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment

GFI KerioConnect Kerio Connect before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of...

CVE-2026-112353 GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment

GFI KerioConnect Kerio Connect before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of...

PT-2026-126661

Name of the Vulnerable Software and Affected Versions GFI KerioConnect versions prior to 10.0.8 Patch 2 Description A stored cross-site scripting XSS flaw exists in the Webmail component. A remote attacker can execute JavaScript within a victim's authenticated session by uploading a specially...

VulnCheck KEV: CVE-2026-112353

GFI KerioConnect Kerio Connect before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of...

CVE-2026-114732

A flaw was found in Roundcube Webmail. In multi-host installations, user authentication using an alias address does not restrict account lookup to the specific Internet Message Access Protocol IMAP host. A remote authenticated user could exploit this flaw to gain unauthorized access to another...

CVE-2026-114724

A flaw was found in Roundcube Webmail. This flaw allows an attacker capable of modifying stored session data to achieve arbitrary code execution through object injection. The vulnerability occurs because session keys prefixed with an exclamation mark are mishandled during session deserialization,...

CVE-2026-114716

A flaw was found in Roundcube Webmail. The application does not properly validate media type values extracted from inline image data URIs when preparing outgoing messages. A remote authenticated attacker can exploit this vulnerability by submitting specially crafted messages with newline characte...

CVE-2026-114727

A flaw was found in Roundcube Webmail. The application allows unsafe image types, specifically Scalable Vector Graphics SVG and Encapsulated PostScript EPS, to be uploaded for contact photos. An authenticated remote attacker can exploit this vulnerability by submitting a crafted image file that...